Warnings / Gotchas

USB 3G Modems

The TL-WR1043ND v1.x does not deliver enough power for most USB 3G modems, which can lead to erratic behavior such as dropped/failed connections. If a 3G USB modem is to be used, consider other routers with a USB port that delivers enough amperes (e.g. the Buffalo WZR-HP-AG300H).

USB 3G modems confirmed working with TL-WR1043ND v1:

Huawei E303

Huawei E303c

Huawei E3131

Huawei E3272

Huawei E3531

Huawei E3533 (via usb-tethering)

ZTE MF823L

ZTE MF190

ZTE MF193

ZTE MF626

ZTE MF667 (via usb-tethering, bad connection)

USB 3G modems confirmed working with TL-WR1043ND v2:

TCT Mobile One Touch X500D

TCT Mobile X220L

ZTE MF632

Vodafone K3765 (Huawei)

Huawei E160E

Huawei E3531

Connection quality drops after a few hours, latency/ping/lag spikes

Only of historical note. Fixed in 14.07 BB and all later builds.
If wireless performance becomes awful after a few hours and ping times to the router over wifi increase up to half a second or more, there's a good chance you're experiencing https://dev.openwrt.org/ticket/12372
Restarting wireless with the "wifi" command makes the issue temporarily go away for the next few hours. Disabling ANI (Adaptive Noise Immunity) with the following command makes the issue go away until the next reboot
echo 0 >/sys/kernel/debug/ieee80211/phy0/ath9k/ani
For more details, including how to disable ANI at boot, see longer description of the same ANI issue on the Cisco WRT160NL page.

Installation

obtain.firmware and Latest OpenWrt Release - required image file is "openwrt-ar71xx-generic-tl-wr1043nd-v1-squashfs-factory.bin" for v1.x routers, "openwrt-ar71xx-generic-tl-wr1043nd-v2-squashfs-factory.bin" for v2.x routers. Files can be found in the "ar71xx" directory. You can use the quick links from the table below. If you have "Please choose a file to upgrade" message again and again, filename is probably too long and you have to rename image to for example firmware.bin.

generic.flashing Now write this firmware-file onto the flash-chip of your device

NOTE: If case you have a revision > v1.10 (but not v2.x), you need to flash an elder OEM firmware release first, and only then flash OpenWrt; tested and works credits go to sayboon for his tutorial

NOTE: For revision v3.0, stock FW 3.16.9 build 150514:
With the current stock TP-Link firmware it's not possible to flash the current stable OpenWrt Chaos Calmer 15.05.1 release for v2 routers. The web interface keeps complaining, that filename and version do not match. Since the hardware of v3 is basically identical to v2, the only problem is the version check during the firmware upgrade. But there is an easy workaround:

Install the current OpenWrt trunk version for v3 via the TP-Link web interface

(after the reboot) Via scp upload the current OpenWrt Chaos Calmer 15.05.1 stable release for v2 to "/tmp/filename", (e.g. with WinScp). After the reboot the router will have the ip-address 192.168.1.1 and the default OpenWrt user and password.

Log in via ssh (e.g. putty) and then execute "sysupgrade -n -F /tmp/filename". The sysupgrade will also complain about version mismatch (v2 vs. v3). But the -F switch forces it to flash the image anyway.

Wait for the process to finish with a reboot and be happy with Chaos Calmer 15.05.1 stable. :)

Download a desired firmware (openwrt *factory.bin or the original firmware wr1043nv1_*_boot*.bin) and rename the *.bin file to wr1043v1_tp_recovery.bin in the tftpboot directory (if you use Tftpd check log viewer for read request from your router, to make sure your rename is correct). The v4 file needs to be named wr1043ndv4_tp_recovery.bin.

On Mac OS X, copy the renamed file to /private/tftpboot/

Use a pin or paper clip to press down the reset button (in the hole besides the power adapter hole) and connect the power, while holding down the reset button for a few seconds

The LEDs should flash indicating firmware upload in progress.

The device will automatically boot to use the new firmware after flashing.

Flashing / Recovery using the serial console

If the tftp only approach doesn't work (due to an old bootloader) or you want to debug the boot process, you will need to attach to its serial console. Depending on your HW version, you will have one or two options to transport the firmware into the device: 1) using tftp, or 2) (v1.x only) using the serial connection itself for file transfer (using the Kermit protocol).

1) Commands when using tftp (lan) for firmware transfer

The tftp server must be listening on 192.168.0.5:69 (configurable with setenv command; use printenv if not sure), and the router must be connected through one of the lan ports. The simplest tftp server to use is dnsmasq: dnsmasq --enable-tftp --tftp-root=/directory-containing-firmware.bin.

The tftp protocol is insecure and sometimes it doesn't work even if the console log suggests otherwise. In such cases you can also use a Kermit client to transfer the new image on the serial connection. It may take forever and a half (15-20min) to transfer the image, but it's easier and more secure than running a tftp server. These instructions assume you're using ckermit on a Linux system, but they will give you all you need to do the same on a Windows box.

Enter the boot prompt on the serial console (see above), and in your terminal program type:

erase 0xbf020000 +7c0000 # 7c0000: size of the firmware (be aware that you may have a different size thus bricking your router)
loadb 0x81000000

Then start ckermit (without any arguments) and run the following commands in it (or configure your Kermit client to these parameters):

set line /dev/ttyUSB0 # Just make sure you got the right USB interface
set speed 115200
set carrier-watch off
set handshake none
set flow-control none
robust
set file type bin
set file name lit
set rec pack 1000
set send pack 1000
set window 5
send firmware.bin # Make sure you include a proper path to the file. That's why I just kept it in /home/$user

After the 15-20min file transfer, the new firmware should be on your router and you can continue in the terminal:

cp.b 0x81000000 0xbf020000 0x7c0000
bootm 0xbf020000

Automated flashing with a script

Version 2.x with newest firmware (3.19.32) hast 192.168.0.1 as default IP and maybe differences in web interface. So this script needs adaption to work for 2.x devices.

Flashing hundreds of devices using the web interface can be a real pain. You can use this shell script to automate it:

#!/bin/bash# Pass the firmware image file to be flashed as the first and only# command line argument.## The second curl call will time out, but it is expected. Once the# script exits, you can unplug the ethernet cable and proceed to the# next router, but do KEEP each router ON POWER until the new image is# fully written! When flashing is done the router reboots# automatically (as shown by all the leds flashing once).
curl \
--user admin:admin \
--user-agent'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0' \
--referer'http://192.168.1.1/userRpm/SoftwareUpgradeRpm.htm' \
--form"Filename=@$1"-F'Upgrade=Upgrade' \
http://192.168.1.1/incoming/Firmware.htm >/dev/null
sleep1
curl \
--max-time2 \
--user admin:admin \
--user-agent'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0' \
--referer'http://192.168.1.1/incoming/Firmware.htm' \
http://192.168.1.1/userRpm/FirmwareUpdateTemp.htm >/dev/null

The v2.x and v3.x get the lan and wan interface not via eth0.1/eth0.2 but via eth0 (wan) and eth1 (lan).
The eth0 is in the same vlan as port 5 on the switch.
Because of that, port 6 on the v2.x, v3.x routers is an additional CPU port - used for wan traffic only.

Wan has VLAN 2, that shouldn't be touched, as you lose the WAN port. Start your VLANs from 3, attaching them to the eth1.x sub-interfaces.

See Schematics:

Some issues with 10.03.1-rc4 on Hardware Ver.1.8 see this post for workaround.

There is a problem with VLAN-IDs > 9 (at least on v1.4 with 10.03.1-RC6 r28680 and v1.8 with 12.09-rc1 r34185). Using a VLAN-ID > 9 makes the router inaccessible on this interface.

VLAN-IDs > 127 not working with Chaos Calmer r47335 on hardware version 2.1.

As mentioned above for v2.x, v3.x:
"Start your VLANs from 3, attaching them to the eth1.x sub-interfaces."

Additional VLAN ID-s must be tagged on CPU port and should be referenced as eth1.<VLAN ID> physical interfaces. To clarify, if multiple VLANs are used only one can be used untagged on switch ports (on CPU port) but it is not necessarily VLAN 1.

Note: the default lan interace (VLAN 1) is preconfigured to use eth1 physical interface (cpu untagged in switch configuration). VLAN 1 can also be tagged on the CPU port but the interface must be changed to eth1.1 from eth1 accordingly.

Note: If we create an additional VLAN, a misleading eth0.<VLAN ID> interface option appears on "Physical Settings" tab in the GUI, but use "Custom interface" option and type eth1.<VLAN ID> (e.g.: eth1.3) instead!

Example: Add additional VLANs on v.2.x hardware

The following is an example where every port in the LAN switch is moved into its own VLAN, creating a five interface router (WAN + LAN x 4).

Failsafe mode

Power up your router. When the 'SYS' LED starts to blink, press the QSS push button repeatedly until the blinking of 'SYS' LED gets faster. Done = You made OpenWrt boot into OpenWrt failsafe mode. Proceed with In OpenWrt Failsafe Mode

WiFi: Using other country regulations

Per default the WLan-"Country Code" is set to US. That means users of OpenWrt worldwide are limited to Channel 1-11.

Using 2 mikrotik routersOS x86 on a vmware machine, doing the bandwidth test through a wr1043n with openwrt 14.07 and basic network/firewall setup, got a stable speed of 210 Mbps (tcp, udp would be higher because easier to handle).

Power

Power Consumption

With a cheap Wattmeter i measured 6.9 W idle and 9 W under load.

PSU (power supply)

My TL-WR1043ND DE (v1.0) came bundled with the following PSU:

Specifications:

TL-WR1043ND DE (v1.0)

TL-WR1043ND v2.1

Brand/Model

Leader Electronics Inc / LEI F7

TP-LINK Tech. co., ltd.

Input

100-240V~ (50/60Hz, 0.6A)

Output

12V 1.5A

Measured output

12.25V

12.40V (w/o load)

The plug (on the router side) has the following specifications:

Outer diameter

5.5mm

Inner diameter

2.1mm

Length of the shaft

9.5mm

I successfully used the ATX PSU (from my computer) to power the router.
All I did was buying a plug with above specifications and soldered a Molex-plug to the other end.

Powering with different Voltages

WARNING: For sure you will lose your warranty if you run the router with too high voltage and I don't guarantee it will work for you. Your router might break, so only run it with too high voltage if you know what you are doing and you don't care if the router breaks.

Because I wanted to run the router directly from solar and the 12V battery can have between 10.4V and 14.8V I tested the router with different voltages and it runs fine with voltages between 10V and 15V. Could not see any failures or loss in performance.

Power consumption on DC-Side

I have measured simultaneously voltage and current on the DC-side of the router with 2 analogue multimeters.

It looks like my AC-DC adapter is stabilized and delivers exactly 12 Volts.

There are only two screws at the back of the device, under the rubber feet. The rest of the case is kept together by two latches at the front of the device, and a system of guides and hooks in the front.

Remove the antennas.

Remove the rubber feet in the back and undo the screws.

Unscrew all three retaining nuts on the antenna connectors and carefully push them into the housing. If you find this hard to do, leave them in place: you'll have to pay attention and avoid pulling the outer frame, as there are wires running from the back of the device all the way to the front of the board.

Push one of the bottom screws back into place to lift the top cover, and keep it that way using a finger.

With the top slightly open, push the bottom cover away. Use a screwdriver if you can't reach it with your fingers.

If you have unscrewed the antenna connectors, now you can remove outer frame. Otherwise just carefully slide it out of the way: this will expose the clips that keep the top and bottom covers together.

With a flathead screwdriver or similar tool, gently pry the two front clips apart. Each clip has two latches and is located near the corners, next to the black front. Put your screwdriver behind the latches and push it towards the ethernet ports.

Now the top cover can slide out the vertical guides on the black front.

The black front also has three plastic hooks that go into matching holes in the bottom cover. To remove it, pull the front away and then push it down.

1. Remove the four screws on the bottom cover.
2. Use a thin object to release the top cover from the bottom cover

Putting it back together

V1.x

Place the board on the bottom cover, so that the two plastic pins at the front keep it in place.

If you undid the antenna connectors, put them back in and tighten the nuts.

Place the outer frame behind the board and make sure it sits flush to the connectors.

Insert the hooks of the front into the holes in the bottom cover, don't push it in yet.

Make the top cover slide into the vertical guides on the front. Don't push it down yet.

Push the front towards the back so the hooks are engaged, then push down the top cover.

Fasten the screws and re-apply the rubber feet.

V2.x

Put the top cover back on

Press until it clicks back nicely to the bottom cover.

Put back the screws

Serial

→ port.serial general information about the serial port, serial port cable, etc.
How to connect to Serial Port:

Solder a header as shown in the picture or wires with a connector directly. The device uses TTL @ 3.3V and not a standard RS-232 Serial that operates between 3 and 15V, so do not try to connect it to a common serial adapter: you will certainly fry the serial circuit or even the whole board. There are plenty of USB to TTL and RS-232 to TTL available on the market, just be careful with the voltage: the standard is 5V and it may also damage your board. Look for the ones with 3.3V or with both voltages and a way to switch between them.

Don’t forget that the TX pin of the serial port must linked to the RX pin of the router and the RX to TX!

If you use the serial connection more often or want to have a permanent modification you can build a stereo audio jack at the back of the router and use the FTDI serial cable TTL-232R-3V3-AJ. As jumper wire you can recycle an old floppy drive power cable.

Receive (RX) Disabled

Some revisions of v1.x require a jumper between the RX serial pin and the resistor R362 to enable serial writes. See this post for details:

GPIOs

The AR913x platform provides 22 GPIOs. Some of them are used by the router for status LEDs, buttons and to communicate with the RTL8366RB. The table below shows the results of some investigation:

Voltage level at GPIO in output-mode

gpioX/value in input-mode when GPIO is:

GPIO

Common Name

PCB Name

gpioX/value=1

gpioX/value=0

Floating

Pulled to GND

Pulled to Vcc

0

→R713

3.3V

0V

1

0

1

1

USB

D18=D9

0V

3.3V

1

1

1

2

SYS

D19=D8

0V

3.3V

1

1

1

3

RESET

SW6

3.3V

0V

1

0

1

4

5

QSS

D31=D10

3.3V

0V

0

0

1

6

7

QSS-Button

SW8=SW9

3.3V

0V

1

0

1

8

Setting data direction to output and value to 0 causes hard reset of the SoC

9

WLAN

D11=D7

0V

3.3V

1

1

1

10

P1-Tx

overriden by tty-kernel module

1

0

1

11

12

13

P1-Rx

3.3V

0V

0

0

1

14

15

USB PSU EN?

→R711

3.3V

0V

1

0

1

16

USB PSU CHK?

→R708

3.3V

0V

1

0

1

17

18

Data line of the RTL8366RB

19

Clock line of the RTL8366RB

20

GPIO20

3.3V

0V

1

0

1

21

To make the GPIOs available via sysfs, the required ones have to be exported to userspace, as it is explained on a page of the Squidge-Project. Kernel modules occupying that resource need to be removed before (e.g. "leds-gpio" and "gpio-buttons"). In output-mode, voltage levels of the GPIOs were measured against GND, after the value 1 or 0 had been written to /sys/class/gpio/gpioX/value. In input-mode, the value of the file /sys/class/gpio/gpioX/value was read when the GPIO was floating (initial state), pulled to GND or pulled to Vcc.

The QSS button is located at the front and can be easily pressed with a finger. The Reset button is located at the back and cannot be pressed with a finger, you need a small item (pen typically) to push it in.

Note: you don't need to configure or activate buttons to get the Failsafe mode working, it will work by default.

Note2: From versions 1.8 up to 2.x holding the reset button for more than 30' resets to OpenWrt initial settings.

Note3: If you use current trunk version of OpenwRT then the reset button is controlled through /etc/rc.button/reset file. If you hold the button for longer than 5 seconds, then OpenWrt resets to initial settings. You can change the behaviour in this file: /etc/rc.button/reset

Debricking

NOTE: If you accidentally bricked your router by overwriting the bootloader, try the following:

Desolder the Spansion SPI-Flash (here is the datasheet) from the board. I used tin foil to "mask" out everything else which I did not want to desolder and used a heat gun. It worked quite nice.

Find a way to connect the SPI flash to something with SPI interface…. I used a AVR microcontroller. Here you can download a pdf containing the layout for the adapter board I made to solder the Spansion SPI flash chip on, in order to connect it to the AVR. Attention, the PDF is mirrored and it is intended to manufacturing boards with the direct toner method.

Write the bootloader into the flash. I got my bootloader out of another wr1043nd.

Solder the chip back into the router.

The router shall now be unbricked.

Bootloader Mods

the uboot version you find on the 1043 is a fork of mainline U-Boot version 1.1.4 from 2005-12-17 see here. You can / you cannot take a current mainline version of uboot and simply cross-compile it for WR1043ND! TP-Link-Version: http://www.tp-link.com/support/gpl.asp. It contains the file u-boot-ap83.tar.bz2 which is about 6,06 MiB in size, deflate this as well. The deflated source code will occupy about 37MiB of space, start with reading the README.

you may be able to cross compile the code with the OpenWrt toolchainBuildroot. See build for guidance. But you may need to use other toolchain to crosscompile, like the ELDK (Embedded Linux Development Kit).

Problem: you cannot test your bootloader, because for some obscure reason, you don't have write access to the flash via JTAG.

Your old MAC Address could be recovered from the sticker in the back of your router. Write it down securely, if in a hard to access location.

Hardware Mods

As a beginner, you really should inform yourself about soldering in general and then even obtain some experience!

64MB RAM Mod

The Device uses a DDR1 16Mbit x 16bit (16Mibit*16=256 mebibit. 256 mebibit/8=32MiByte) 400MHz chip. Replace it with any 32Mbit x 16bit chip. 333MHz instead of 400MHz also works fine. It's quite hard to find these chips. The best chance is to have a look at DDR-SODIMM. Since there are no 64Mbit x 16Bit DDR1 Chips available → no 128 MB mod!

I²C GPIO Mod

An I²C-bus can easily be added using the GPIO-lines of the AR913x-SoC. So far, the only usable ones which have been confirmed to work are GPIO 0 (the unpopulated R713 located in the bottom right corner of the SoC, using the pad facing R714), GPIO 5 (the QSS-LED, easily soldered at D10,left pin with '+') and GPIO 20 (labeled on the pcb, next to the RAM chip, easily soldered from the bottom side). Using GPIO 0 and 20 may be the best choice, as they are not used, so there are no issues about removing the LED driver(bindings) or pcb components. If GPIO 5 has to be used, it should be used for SDA (it has less level changes than SCL). There are only two pull-up resistors of 4,7k-10k needed, which have to be soldered between the appropriate GPIO line and Vcc (found at the spot labeled TP3V3, about 2 cm above the WiFi-shielding). The common ground can be obtained from the TP_GND spot (between P1 and the flash chip). Remember this bus runs at 3.3V level, when connecting I²C-devices.
To improve signal integrity (in this case namely a solid logic low level on GPIO 5), you can replace R373 with a piece of wire and remove the LED D31. R373 seems to be the current limit resistor for the LED D31.

Make sure to install package kmod-i2c-gpio-custom.
To load the kernel module (with SCL=GPIO 0 and SDA=GPIO 20), do a:

insmod i2c-gpio-custom bus0=0,20,0

If your I2C-bus runs successfully, you can enable it on boot by creating a file in /etc/modules.d called "55-i2c-gpio-custom" with the options appropriate to your bus configuration. For example:

i2c-gpio-custom bus0=0,20,0

A more convenient way to add an I2C-bus to this router, without a modification of the internal hardware (and risking your warranty), is using the I²C Tiny-USB adapter. The downsides are, that it is not as cheap as the I²C-GPIO mod, and the longterm-stability is lower (temporary USB disconnects can occur randomly or due to EMI, but the I2C-subsystem is not designed for sudden disconnects). Remember this bus runs at 5V level, when connecting I²C-devices.

Flash Mod

You can install 16 MB flash Winbound 25Q128

How to flash Chaos Calmer (15.05) into the V3 version with the V2 OpenWrt factory file

Since there is another TP-Link software installed on the V3 version of the router which does not accept the firmware file for the V2 version it is not possible to install CC on it.
But there is a little trick to install it anyways.